Japan

The Act establishes an AI Strategic Headquarters within the Cabinet and requires the government to adopt an AI Basic Plan (Chapters III and IV), and states the national government's, local governments', research institutes', and AI-utilization business operators' basic responsibilities toward AI research, development, and use (Chapter I).

Article 7 asks a utilization business operator only to endeavor to make active use of AI in its business activities and to cooperate with the government's AI-promotion measures; the Act creates no disclosure, labelling, risk-management, or human-oversight duty running to a person affected by an AI system, and its text carries no penal-provisions chapter, so a breach of Article 7 carries no stated sanction.

A 2026 amendment inserting a new Article 142-5 into the Public Offices Election Act requires a person who distributes, over the internet, election-campaign material or anti-candidate campaign material carrying an image or video that AI-related technology created or altered, to display that fact on the screen of the recipient's device, unless the alteration is minor by common social understanding or the content carries no risk of being mistaken for an actual recording. The amendment (Act No. 58 of Reiwa 8) was enacted and promulgated on 17 July 2026, and takes effect on 1 March 2027.

A new Specific Biometric Personal Information category (Art. 16(5)) covers an individual identification code converted from a bodily feature that is obtainable without special technology or great expense and that a Cabinet Order specifies as one the data subject cannot easily recognize is being captured, aimed at facial-recognition data captured passively.

A business handling it must give advance purpose-of-use notice (Art. 21-2), may not rely on the ordinary opt-out mechanism to provide it to a third party (Art. 27(2)), and must honor a data subject's request to stop using it or providing it to a third party even absent any illegality (Art. 35(7)-(8)), a use-cessation right the current Act's individual identification code category does not carry. The Act comes into force on a day a Cabinet Order sets within two years of its promulgation.

APPI reaches biometric identifiers through the concept of an individual identification code (Art. 2(2)(i)): a code converted to identify a specific individual by a distinguishing physical feature. This definition sits among the Act's Chapter I general provisions, so it binds both the private-sector duties in Chapter IV and the administrative-entity duties in Chapter V of the Act.

Cabinet Order Art. 1 enumerates the covered features and names both facial appearance and vocal characteristics expressly, alongside DNA base sequence, iris pattern, gait, and palm or hand vein pattern.

Personal information containing an individual identification code is personal information in itself, without needing to be combined with other data, but it sits outside the Art. 2(3) sensitive personal information category, so its capture does not trigger the Art. 20(2) prior-consent requirement that applies to race, health data, and similar categories.

Disclosure to a third party instead falls under the general third-party-provision rule in Article 27, which requires the data subject's consent unless an exception applies, and the opt-out mechanism in Article 27(2) remains available for data containing an individual identification code, because that mechanism excludes only sensitive personal information, data acquired in violation of the Act's rule on proper acquisition, and data received from another business under the opt-out itself.

Art. 26(1) requires a business to report to the Personal Information Protection Commission any leak, loss, or damage of personal data that PPC order identifies as likely to harm individual rights and interests, following PPC-set procedure and timing; no duplicate report is needed where an entrusting business has already been notified. The administrative-entity mirror duty sits at Art. 68.

The PPC's own order or rules set the specific report-timing thresholds and the individual-notification trigger; the Art. 26 duty is summarised without that procedural detail.

The Act on the Protection of Personal Information (APPI) is Japan's single comprehensive personal-data statute, covering private businesses (Chapter IV), administrative organs (Chapter V), and independent administrative agencies since the 2021 merger amendment folded the former separate acts into one text.

Lawful basis is purpose-of-use notice under Arts. 17 and 21 (specification of purpose of use, and notice or public disclosure of purpose of use at the time of acquisition) plus a general prohibition on wrongful acquisition under Art. 20(1); there is no General Data Protection Regulation (GDPR)-style enumerated legal-basis list. APPI regulates businesses handling personal information directly rather than a controller and processor split, and Art. 25 imposes supervision duties over any entrusted processor.

Article 42(4), inserted by Act No. 56 of Reiwa 8, applies Article 31-2 to a business handling pseudonymized personal information in its handling of pseudonymized personal information that contains the descriptions Article 2(8) lists, including information that can easily be collated with other information to identify those descriptions.

Article 46-2, inserted by the same Act, applies Article 31-2 in the same way to a business handling anonymized personal information in its handling of anonymized personal information that contains those descriptions. Article 31-2 provides that a business must not use contactable personal-related information by a method likely to encourage or induce an illegal or unjust act, and must not acquire it by deceit or other wrongful means. The Act comes into force on a day a Cabinet Order sets within two years of its promulgation.

Article 40-2(1) of the Act, inserted by Act No. 56 of Reiwa 8, provides that where a personal information handling business operator handles the personal information of a person under 16, the provisions it lists apply with the words for the data subject read as the data subject's legal representative, subject to specified adjustments.

The provisions it lists are Article 18, Article 20(2), Article 21, Article 21-2(1), Article 26(2), Article 27, Article 28, Article 30-2(1) and (5), Article 32(1) and Article 35(7).

The reading does not apply where the operator has a justifiable reason for not knowing that the information is a person under 16's, where the person's legal representative permitted the person's business and the operator acquired the information in connection with it, or where the person has no legal representative or the operator has reasonable grounds to believe there is none.

Article 40-2(2) applies a similar reading to Article 31(1) where a business handling information related to personal information handles such information about a person under 16, with the same three exceptions. Article 35(9) lets a person under 16 ask a business operator to cease using, or to stop providing to a third party, retained personal data that identifies the person, except in the cases it lists.

Article 35(10) requires the operator to cease the use or stop the provision without delay once such a request is found justified, unless doing so costs a large sum or is otherwise difficult and the operator takes alternative measures needed to protect the person's rights and interests. Article 71-3 applies the same reading to administrative organs. The Act comes into force on a day a Cabinet Order sets within two years of its promulgation.

Pseudonymized personal information is information prepared so that a specific individual cannot be identified unless it is collated with other information (Article 2(5)), and anonymized personal information is information prepared so that a specific individual cannot be identified and the personal information cannot be restored (Article 2(6)).

A business handling personal information that prepares pseudonymized personal information must process the data to the standards the Personal Information Protection Commission sets (Article 41(1)), must secure the deleted information and the means of processing against leaking (Article 41(2)), and must keep to the specified purpose of use (Article 41(3)).

A business handling pseudonymized personal information must not collate it with other information in order to identify the person the information came from (Article 41(7)).

A business handling pseudonymized personal information must not provide pseudonymized personal data to a third party except in cases based on laws and regulations (Article 41(6)), and must not provide pseudonymized personal information that is not personal information to a third party except in cases based on laws and regulations (Article 42(1)).

Article 42(3) applies Articles 23 to 25, Article 40 and Article 41(7) and (8) to the handling of pseudonymized personal information by a business handling pseudonymized personal information, so the ban on identifying a person by collation binds a recipient as well as the business that prepared the information.

A business handling personal information that prepares anonymized personal information must process the data to the Commission's standards so that a specific individual cannot be identified and the information cannot be restored to its original state (Article 43(1)), must secure the deleted identifiers and the processing method against leaking (Article 43(2)), and must disclose the categories of individual information the anonymized information contains (Article 43(3)).

Before providing anonymized personal information it prepared to a third party, it must disclose those categories and the means of providing it and state explicitly that the information is anonymized personal information (Article 43(4)), and when handling anonymized personal information it prepared itself it must not collate it with other information in order to identify a person (Article 43(5)).

A business handling anonymized personal information that did not prepare it must make the same disclosure and statement before providing it to a third party (Article 44), and must neither acquire the deleted identifiers or the processing method nor collate the anonymized personal information with other information in order to identify a person (Article 45), so the ban on identifying a person binds a recipient as well as the creator.

Both must endeavor to take the necessary and appropriate security and complaint-handling measures and to disclose them (Articles 43(6) and 46). The duties bind a business handling personal information, pseudonymized personal information or anonymized personal information, a class that excludes national government organs, local governments and incorporated administrative agencies (Article 16(2), (5) and (6)).

A business handling personal information that provides personal data to a third party must prepare a record of the date of provision, the third party's name and the other matters the Personal Information Protection Commission's rules set, and keep it for the period those rules set.

A business that receives personal data from a third party must first confirm the third party's name and address and how the third party acquired the data, then prepare and keep a record of the date of receipt and the matters confirmed. Under the Commission's Enforcement Rules the record is kept for three years in the usual case, and for one year after the last provision or receipt where a contract or other document that already holds the required items stands in as the record.

The record duties do not apply to a provision or receipt that falls under an item of Article 27, paragraph (1) or (5). They bind a business handling personal information, a term that excludes national government organs, local governments and incorporated administrative agencies.

New Arts. 30-2 and 31-3 create a statistics creation etc. exemption, defined at Art. 2(13) as extracting and analyzing large volumes of information to produce trend or characteristic information of a kind the Personal Information Protection Commission's rules find low-risk to individual rights, letting a business acquire already-public sensitive personal information, or provide personal information or personal-related information to a third party, for that purpose without the data subject's consent, conditioned on publishing the statistics-creation details online and, for third-party provision, a written agreement so stating; the recipient may not use the data beyond the published purpose or pass it on further.

A parallel exemption at Arts. 69(2)(4) and 72-3 lets an administrative organ provide held personal information for the same purpose. The Act comes into force on a day a Cabinet Order sets within two years of its promulgation.

Art. 28 requires a data subject's prior consent before a business transfers personal data to a third party in a foreign country, unless the destination country is one the Personal Information Protection Commission (PPC) has recognized as having an equivalent personal-information protection system, or the recipient has established a system that continuously ensures measures equivalent to APPI's own Section 4 duties.

Before seeking consent, the business must disclose the destination country's protection system and the recipient's own measures. This is a real consent-or-adequacy restriction, moderate rather than absent; there is no general data-localization mandate in APPI itself.

A new Chapter VI power (Arts. 148-3 through 148-17) requires the Personal Information Protection Commission to order a personal-information handling business to pay a surcharge, to the national treasury, equal to money or another benefit the business received as consideration for providing personal information to a third party under circumstances where it was expected the recipient would use it for an illegal act or unjust discriminatory treatment, or for ceasing that conduct.

The Commission may not order payment where the business exercised reasonable care to prevent the conduct throughout the relevant period, where the data subjects affected number 1,000 or fewer, or in another case a Cabinet Order designates as not significantly harming individual rights and interests. The surcharge amount can be increased for a repeat violation or reduced for voluntary pre-investigation disclosure under Arts. 148-4 through 148-17. The Act comes into force on a day a Cabinet Order sets within two years of its promulgation.

The Personal Information Protection Commission (PPC) is Japan's independent supervisory authority, holding recommendation and order powers under Chapter VI. Violating a PPC order under Art. 148(2) or (3) is a criminal offense under Art. 178, punishable for an individual by imprisonment with work for not more than one year or a fine of not more than JPY 1,000,000.

A data subject can sue to enforce a disclosure, correction or cessation request under Arts. 33 to 35, after first making the advance request Art. 39 requires. A claim for compensation runs through general tort law under Civil Code Art. 709, outside APPI itself.

Article 2(4) defines an act of unauthorized computer access as operating a specified computer that carries an access control feature, in a way the feature restricts, by inputting via a telecommunications line another person's identification code associated with that feature, or other information or a command designed to evade the feature.

Article 3 prohibits any person from engaging in such an act; violating it is punished under Article 11 by imprisonment for not more than three years or a fine of not more than 1,000,000 yen. The Act also prohibits obtaining, storing, or supplying such an identification code for that purpose, and impersonating an access administrator to solicit one (Arts. 4 through 7), each punished less severely under Articles 12 and 13.

Because every prohibited act requires defeating an access control feature the target computer already carries, reading a public, unauthenticated page that carries no such feature falls outside a plain reading of the Act. The sections this entry groups came into force on different days.

Article 168-2(1) of the Penal Code punishes a person who, without a legitimate reason and for the purpose of having it run on another person's computer, creates or provides an electronic record that gives an improper command causing a computer, when a person uses it, not to act as that person intends or to act contrary to that intent, or a record describing such a command. That offence is punished by imprisonment for not more than three years or a fine of not more than 500,000 yen.

Article 168-2(2) applies the same penalty to a person who, without a legitimate reason, puts a record of the first kind, one that itself gives the improper command, into execution on another person's computer. Article 168-2(3) punishes an attempt at that second offence. Article 168-3 separately punishes acquiring or storing such a record for the same purpose, by imprisonment for not more than two years or a fine of not more than 300,000 yen.

The offence was added to the Penal Code by Act No. 74 of 2011, promulgated on 24 June 2011. It took effect on 14 July 2011.

Article 2, paragraph 1, item 20 of the Copyright Act defines a technological protection measure as an electromagnetic means of preventing or deterring acts that infringe copyright or related rights, other than a means used without the will of the right holder, that works either by having the equipment used with the work record or transmit a signal that triggers a particular response, or by converting the work into a form that requires a particular conversion.

Item 21 defines a technological restriction measure as an electromagnetic means of restricting the viewing of a work or other protected subject matter, including running a computer program, other than a means used without the will of the right holder, that works by the same kinds of signal or conversion method.

Article 30, paragraph 1, item 2 removes the private-use copying exception for a copy made knowing that circumvention of a technological protection measure made the copying possible, or removed an obstacle to its result.

Article 113, paragraph 6 deems the act of circumventing a technological restriction measure, that is, making possible the viewing of a work it restricts by interfering with its effect, to infringe the copyright, publication right or neighboring right concerned, except where the act is done within a scope justified for research or technology development relating to the measure or otherwise does not unreasonably harm the interests of the right holder.

Article 113, paragraph 7 deems it an infringement to transfer or lend to the public, to manufacture, import or possess for that purpose, to offer for public use, or to transmit publicly or make transmittable, a command code whose function is to circumvent a technological protection measure or a technological restriction measure.

Article 120-2 provides imprisonment of up to three years or a fine of up to three million yen, or both, for a person who supplies to the public a device or program whose function is such circumvention, for a person who as a business circumvents such a measure at the public's request, and for a person who commits an act that Article 113, paragraph 7 deems an infringement.

Article 2, paragraph 1, item 17 of the Unfair Competition Prevention Act makes it unfair competition to transfer, deliver, display for transfer, export or import a device or program having the function of making possible, by interfering with the effect of a technological restriction measure used in business, the viewing of images or sound, the running of a program, the processing of information or the recording that the measure restricts, or to provide such a service.

Item 18 covers the same acts done to a person other than the specified persons where the technological restriction measure is used in business to prevent anyone other than specified persons from viewing, running, processing or recording.

Article 21, paragraph 3, item 4 of that Act provides imprisonment of up to five years or a fine of up to five million yen, or both, for a person who commits the unfair competition in item 17 or 18 for the purpose of obtaining an unlawful profit or of causing damage to the person using the technological restriction measure in business.

Under supplementary provision 1 of the Act amending the Copyright Act (Act number 77 of 1999), the amendments to Article 2, paragraph 1, Article 30, paragraph 1, Article 113 and Article 119 and the new article inserted after Article 120 took effect on October 1, 1999, ahead of the rest of that Act on January 1, 2000.

Article 30-4 permits exploiting a copyrighted work, by any method and to the extent considered necessary, whenever the purpose is not to personally enjoy or cause another to enjoy the thoughts or sentiments the work expresses, including reproduction for information analysis such as AI model training, unless doing so would unreasonably prejudice the copyright owner's interests given the work's nature and use and the manner of the exploitation.

The exception's only express limit is whether the exploitation would unreasonably prejudice the copyright owner's interests in light of the work's nature or purpose or the circumstances of the exploitation; official guidance from the Agency for Cultural Affairs treats defeating a technical measure such as robots.txt as one basis for finding that limit reached where the work is a database built and marketed for information analysis.

The exception was inserted by Act No. 30 of 2018 and came into effect 1 January 2019. Exploiting a work outside the scope of this or another statutory exception is copyright infringement under Art. 119(1), punished by imprisonment for not more than ten years, a fine of not more than 10,000,000 yen, or both.

Article 41(1) of the Act requires a telecommunications carrier that installs telecommunications line facilities to keep the telecommunications equipment it uses for its business in conformity with the technical standards the ministerial order sets. Article 41(6) requires those technical standards to ensure that equipment damage or failure does not seriously impede service, that service quality is appropriate and that the secrecy of communications is not violated.

Article 43(1) lets the Minister order a carrier to repair or modify equipment that does not meet the technical standards, or restrict its use. Article 44(1) requires a carrier to draw up management rules for its business equipment and to notify them to the Minister before starting its business. Article 44-3(1) requires a carrier to appoint a chief telecommunications equipment manager who supervises the equipment management policy, structure and methods.

A fine of up to 2,000,000 yen punishes the violations listed in Article 186 of the Act. One listed violation is failing to appoint the chief telecommunications equipment manager that Article 44-3(1) requires. The Act took effect on 1 April 1985.

Article 28(1) of the Act requires a telecommunications carrier to report to the Minister of Internal Affairs and Communications without delay, with the reason or cause, a leak of the secrecy of communications or another significant accident the ministerial order names. Article 28(2) requires a carrier to report without delay, with the reason or cause, a situation the ministerial order names as likely to lead to such an accident.

A fine of up to 300,000 yen punishes the violations listed in Article 188 of the Act. One listed violation is failing to make, or falsely making, the report that Article 28(1) requires. The Act took effect on 1 April 1985.

A person is a young person (seishonen) under this Act if under 18. Before concluding a mobile phone or PHS internet-connection service contract, the carrier must confirm whether the counterparty is a young person and, if not, whether the actual device user is (Art. 13).

The carrier must then provide the internet connection conditional on use of a youth-harmful-information filtering service whenever the contracting party or device user is a young person, unless the young person's guardian opts out (Art. 15), and a seller of a covered mobile handset must implement filtering-enabled measures on the same conditional basis (Art. 16).

A general (fixed-line) internet connection provider must supply filtering software or a filtering service on request from any user (Art. 17). A manufacturer of an internet-connectable device must build in or otherwise ease the use of filtering software before selling the device (Art. 18), and a developer of software that directly controls such a device's operation must make a best-efforts attempt to the same end (Art. 19). The Act carries no penalty, fine, or administrative-order provision for a violation of any of these duties.

A child under this Act is a person under 18 (Art. 2(1)). An internet dating (opposite sex introduction) service operator must, per National Public Safety Commission rule and in advance, confirm that a person seeking correspondence is not a child before relaying that person's information to another user or letting the two exchange contact details, unless the operator's own prior identity-confirmation procedure already covers that person (Art. 11).

The operator must also display and communicate a notice that children may not use the service (Arts. 9-10) and must notify the National Public Safety Commission before starting the business (Art. 7(1)). The prefectural Public Safety Commission may direct an operator that breaches the Act to correct the breach (Art. 13) and may order a suspension of up to six months, or a closure, for specified further violations (Art. 14).

Violating a suspension or closure order carries imprisonment up to one year, a fine up to JPY 1,000,000, or both (Art. 31). Operating without the required notification, breaching the Art. 9 duty, or violating an Art. 13 or Art. 15(2)(i) instruction carries imprisonment up to six months or a fine up to JPY 1,000,000 (Art. 32).

A false or missing notification under Art. 7 carries a fine up to JPY 300,000 (Art. 34), and a company is fined the same amount as its employee or agent under the dual-liability rule (Art. 35). The sections this entry groups came into force on different days.

Article 21 of the Copyright Act gives the author of a work the exclusive right to reproduce the work. Article 2(1)(xv) defines reproduction as the physical replication of a work through printing, photography, or copying, through the recording of sound or visuals, or in any other way.

Article 23(1) gives the author the exclusive right to transmit the work to the public, which includes the right to make the work available for transmission if it is to be transmitted to the public via automatic public transmission. Article 2(1)(ix)-4 defines an automatic public transmission as a transmission to a member of the public, other than a broadcast or cablecast, that is made automatically in response to a request from the member of the public.

Article 2(1)(ix)-5 defines making a work available for transmission as making it available to be transmitted via automatic public transmission through either of two kinds of action, putting data on an automatic public transmission server that is connected to a public telecommunications network, or connecting to such a network a server that already holds the data. Articles 30 through 50 of the Act set out the limitations of copyrights.

Article 112(1) allows the author, copyright owner, owner of print rights, performer or owner of neighboring rights to file a claim against a person who is infringing or who is likely to infringe the copyright, or another of those rights, for the cessation or prevention of the infringement.

When filing that claim the right holder may also demand the destruction of objects that give rise to an act of infringement, objects made through an act of infringement, or machines or tools used solely for an act of infringement, or demand any other measure necessary for the cessation or prevention of the infringement.

Article 119(1) punishes a person that infringes a copyright, print rights or neighboring rights, subject to the exceptions it lists, with imprisonment for a term of up to ten years, a fine of up to ten million yen, or both. Article 119(2) punishes the persons it lists with imprisonment for a term of up to five years, a fine of up to five million yen, or both.

Those persons include, at item (v), a person that made available or presented a computer program facilitating the exploitation of an infringing work to the public. Article 113(2)(ii) describes such a program as one found to be deliberately leading the public to an infringing work when providing a transmitter identification code by means of the program, or one found to be used mainly for the exploitation of an infringing work by the public.

Item (v) of Article 119(2) excludes a person that merely provided the opportunity to make the program available on a website that includes a considerable number of other websites, or on a website used for a considerable number of programs, unless that person has continuously for a considerable period of time and without reasonable grounds failed to comply with a request from the copyright owner for the deletion of the infringing transmitter identification codes, or there are other special circumstances under which the person's action is found to unreasonably prejudice the interests of the copyright owner.

Article 123(1) provides that prosecution for the offence in Article 119(1) through (3), among others, may not be instituted unless an accusation is filed by the injured party. Article 123(2) disapplies that requirement for an offence under Article 119(1) committed by the acts its items set out, for the purpose of gaining a financial benefit in consideration of the act or of damaging the profit that the copyright owner is expected to gain by making available or presenting a fee-based work.

Article 124(1)(i) punishes a corporation whose representative, agent, employee or other worker commits an offence under Article 119(1) in connection with its business with a fine of up to three hundred million yen, in addition to the punishment of the offender. Article 62(1) of the Penal Code provides that a person who aids the principal offender is an accessory.

Article 8 of the Penal Code applies the general provisions of its Part I to crimes for which punishments are provided by other laws and regulations, except when those laws and regulations provide otherwise. The Copyright Act comes into effect on January 1, 1971.

Article 32(1) permits quoting and thereby exploiting a work that has already been made public, provided the quotation is consistent with fair practice and stays within a scope justified for the purpose of news reporting, critique, research, or another purpose for which the work is quoted.

This is the general ground under which reproducing a headline or a short extract of third-party journalism could be justified without the rights holder's authorization; it is a fair-practice standard rather than a fixed word or length threshold. A quotation exceeding this scope is copyright infringement, punished under Art. 119(1) by imprisonment with work for not more than ten years, a fine of not more than 10,000,000 yen, or both.